LastPass Suffers Another Breach, and This Time Customer Data Is Affected

The data breach LastPass suffered in August enabled a hacker to infiltrate the company again and steal customer information. 

On Wednesday, LastPass announced it was investigating the breach, which involved a third-party cloud storage service connected to company systems. 

“We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information,” the company wrote in a blog post. 

This Tweet is currently unavailable. It might be loading or has been removed.

What data was stolen remains unclear. But LastPass has said customers' passwords should remain safe, since the company doesn’t store information on the “Master Password” customers use to access the encrypted password vaults over the platform.

“We are working diligently to understand the scope of the incident and identify what specific information has been accessed. In the meantime, we can confirm that LastPass products and services remain fully functional,” the company said.  

Still, the incident shows the August breach at LastPass was more serious than initially thought. At the time, the company said the August breach only ensnared its internal systems for software development —not any data concerning customer passwords. Nevertheless, the hacker was able to steal portions of company source code and some proprietary LastPass technical information, which likely paved the way for the follow-up intrusion. 

In September, LastPass also said it had concluded its investigation into the breach with the help of cybersecurity firm Mandiant. The results found the hacker only had access to the internal systems for four days. No evidence was found of any tampering either. But it seems LastPass still failed to uncover all the potential ways the hacker could use the access to breach the company again.  

Recommended by Our Editors

US Indicts Ukrainian for 'Raccoon Stealer' Malware That Hit Millions of Computers

Hacker Phishes Dropbox to Steal Access to Company Code

What to Do When You've Been Hacked

LastPass didn’t name the third-party cloud storage service the hacker used to breach the company for a second time. But LastPass has been sharing the cloud storage service with its affiliate GoTo. Both companies are currently owned by private equity firms.  

In response to the new breach, LastPass has deployed additional security measures and monitoring of the company’s IT infrastructure. It's also contacted Mandiant and law enforcement about investigating the hack.